Out-of-Bounds Read Vulnerability in Qt's QTextCodec Functionality

CVE-2026-9499

What is CVE-2026-9499?

An out-of-bounds read vulnerability exists within the QTextCodec::codecForName() method in the Qt framework. This issue arises when the function is invoked with a non-NUL-terminated QByteArray, such as those generated via QByteArray::fromRawData(). The codec-name matching process may read beyond the bounds of this buffer, potentially leading to the selection of an incorrect text codec. Although this generally does not leak data, it can result in a denial of service if the read reaches unmapped memory, causing the application to crash. Applications that properly utilize NUL-terminated QByteArrays remain unaffected. The vulnerability affects the Qt5Compat module in Qt 6.0.0 and newer, as well as the Qt Core (qtbase) module in Qt versions 4.x and 5.x.

References